5b9d8d3e3b50e5a24ee5baaef9190d21ced51471197b81a23075edbe8f2b7c08

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 04:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

972bdf42a33a9058f2bf78b98bde12f0N.exe
Size

43KB
MD5

972bdf42a33a9058f2bf78b98bde12f0
SHA1

ceeb97525cd6dd32e76318aa1c7ed3404e9e2860
SHA256

5b9d8d3e3b50e5a24ee5baaef9190d21ced51471197b81a23075edbe8f2b7c08
SHA512

8c9a83d54c5c1d95839e88dd97c45b1c7a1f0ce5a87ea99a98dc64736eb6d7cfdd57c0dbaad891ffba16daa9686559a1935cf8bb2c82da567862ec74119adfb4
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/FzzwzfgQemyq8gCgQemyq8ggOE:/7BlpQpARFbhNIRynyX

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3439) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util.gui_1.7.0.v200903091627.jar.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench_1.2.1.v20140901-1244.jar.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santa_Isabel.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mazatlan.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qatar.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_zh_CN.jar.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multiview.xml.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\simplexml.luac.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Stockholm.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Resources.dll.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Microsoft Games\Chess\ChessMCE.lnk.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libcache_read_plugin.dll.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-spi-actions.jar.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\AST4ADT.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libtcp_plugin.dll.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\.eclipseproduct.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Paramaribo.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Paris.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\liblive555_plugin.dll.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.contexts_1.3.100.v20140407-1019.jar.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-services.jar.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\ja-JP\Minesweeper.exe.mui.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\ChkrRes.dll.mui.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-print.jar.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Rangoon.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jre7\bin\java.dll.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Pyongyang.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.console_1.1.0.v20140131-1639.jar.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Baku.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\vlc.mo.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libfps_plugin.dll.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro_5.5.0.165303.jar.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActions.exsd.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_zh_4.4.0.v20140623020002.jar.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Manila.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jconsole.jar.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Mozilla Firefox\firefox.cfg.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\artifacts.xml.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\msvcr100.dll.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe
File created	C:\Program Files\Java\jre7\lib\flavormap.properties.tmp	972bdf42a33a9058f2bf78b98bde12f0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	972bdf42a33a9058f2bf78b98bde12f0N.exe

C:\Users\Admin\AppData\Local\Temp\972bdf42a33a9058f2bf78b98bde12f0N.exe
"C:\Users\Admin\AppData\Local\Temp\972bdf42a33a9058f2bf78b98bde12f0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
43KB

MD5
dd70363eb5265451794df32ced2bade1

SHA1
5f33a540d2a87b99afbefec096bf8bbfad9c9aa4

SHA256
65e0a9b2f638924f6776319c02e7adbba6d0529c3b7ea382d1a9278e3012d58f

SHA512
f100f8ea04752f0f4c60c69aed9f6b6c425dbb6266f00213804f9e563384720c87aec69565da4ae35fd3054020f172d067b33fa8b487e01beb342c3e235ee939

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
52KB

MD5
c0e2efb75bb3af2e90388b86b2e4e3ed

SHA1
d752912c017160c06bb0a20155a4cf90a622f850

SHA256
527867bf249e2b8d3287cf7f89a47f6731b10485ee2d1a6846551b94a2d20ed8

SHA512
684edddeff4b6e0e4659dfca7b34da79f2182b70a5498c93258b0bfb8300f89b9040ba2d775374c380b2d4c9a5912c8269d2ba688a2d5cf3e03ac9d713ba0b08

Download Submit
memory/2292-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2292-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download